A digital forensic profiling triage model for industrial espionage

In the digital age, information technology has become crucial for business success and, simultaneously, an attractive target for theft. Stealing trade secrets from others, though risky yet relatively straightforward, has often enabled latecomers to rise to the top tier at minimal costs, both in terms of time and money. As a result, industrial espionage has emerged as one of the most serious and prevalent threats to the long-term growth of business in many companies. However, addressing industrial espionage in the digital age presents significant challenges for law enforcement agencies that are less tech-savvy due to the following issues: First, the proliferation of digital devices has led to an explosion of data. This data is incredibly diverse, ranging from personal photos, messages, and bank transactions to work documents and emails, and intermingled. Second, people are increasingly worried about their information being hacked and tracked through digital devices. Therefore, law enforcement agencies should adapt their investigation procedures to a less invasive manner to enhance data privacy. Third, compared to other crimes, investigating industrial espionage is more time-consuming, tiresome, and sophisticated. It involves numerous digital devices and systems, as well as a wide range of complex criminal activities that may be linked to various facts or claims. Fourth, digital forensic investigators responsible for data collection and analysis often lack comprehensive knowledge of industrial espionage, particularly regarding the patterns of the offense, which leads to gathering irrelevant or insufficient data or collecting devices without discretion. This approach results in a massive examination backlog in forensic labs, and it raises concerns about data privacy and due process in court. Fifth, prosecutors or case investigators have faced the challenge of understanding critical information in a forensic report because of the technical complexity of digital data, such as metadata, geotags, logs, registry entries, artifact records, and more. When properly understood, these below-the-iceberg data can provide a wealth of information about who did what, when, and where. This dissertation presents a digital forensics profiling triage model (DFPM) designed to address these issues related to industrial espionage. This model utilizes two different disciplines to generate digital profiles: digital forensic triage techniques, which focus on artifacts and metadata analysis, and crime profiling techniques, which focus on the identification of crime profiles based on investigative experience and cognitions. DFPM comprises four main parts: developing a profile template, preparing digital data, generating digital profiles, and verifying digital profiles. Part 1 (developing a profile template) generates typical crime profiles of industrial espionage offenses through the crime profiling process after examining multiple incidents of the same type of crime. Crime profiles resulting from chapter 4 will be used as a template to identify digital profiles in DFPM. Part 2 (preparing digital data) prepares digital data from a computer for application in digital profiling through the file classification and profile mapping processes. Particularly in the profile mapping, each crime profile created in chapter 4 is mapped to one of the file groups categorized in the file classification. Part 3 (generating digital profiles) generates digital profiles for a case through the digital profiling process. It consists of profile data gathering, digital profile recognition, and crime montage. Profile data gathering identifies profile data used to generate digital profiles from online or offline events extracted from various data using profile constraints inferred from the crime profiles. The digital profile recognition generates more human-readable digital profiles using profile data. The crime montage process provides the most reasonable crime scene scenario by integrating digital profiles into chronological order. Part 4 (verifying digital profiles) verifies the reliability and sufficiency of DFPM’s outcomes by assessing if there are inconsistencies between distinct profile data derived from the same events and whether digital profiles can sufficiently draw a crime scene scenario. Finally, this dissertation provides a prototype tool for DFPM and demonstrates the application of the digital profiling process and digital profile verification process of DFPM through the NIST CFReDS data leakage case study. This research contributes to industrial espionage investigations at crime scenes, especially within limited timeframes and with shortages of skilled personnel, by generating an overall crime scene scenario built with digital profiles. By improving comprehension of the crime incident, it could prevent any needless, in-depth investigations to save money and time needed for digital investigations. It also contributes to the body of knowledge by creating a new digital profiling system.